################################################################################
#
# This script was written by Carsten Koch-Mauthe <c.koch-mauthe at dn-systems.de>
#
# This script is released under the GNU GPLv2
#
# $Revision: 03 $
#
# Modified to implement through 'smb_nt.inc'
#- By Nikita MR <rnikita@secpod.com> on 2009-09-17
#
################################################################################

if(description)
{

 script_id(90027);
 script_version ("$Revision: 03$");
 script_tag(name:"cvss_base", value:"10.0");
 script_tag(name:"risk_factor", value:"Critical");
 script_cve_id("CVE-2008-1948");
 name = "GnuTLS < 2.2.4 vulnerability (Win)";
 script_name(name);

 desc = "The remote host is probably affected by the vulnerabilities described in
 CVE-2008-1948, CVE-2008-1949, CVE-2008-1950

GnuTLS < 2.2.4 vulnerability

Impact

   CVE-2008-1948
     The _gnutls_server_name_recv_params function in lib/ext_server_name.c
     in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly
     calculate the number of Server Names in a TLS 1.0 Client Hello
     message during extension handling, which allows remote attackers
     to cause a denial of service (crash) or possibly execute arbitrary
     code via a zero value for the length of Server Names, which leads
     to a buffer overflow in session resumption data in the
     pack_security_parameters function, aka GNUTLS-SA-2008-1-1.

   CVE-2008-1949
     The _gnutls_recv_client_kx_message function in lib/gnutls_kx.c
     in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to
     process Client Hello messages within a TLS message after one has
     already been processed, which allows remote attackers to cause a
     denial of service (NULL dereference and crash) via a TLS message
     containing multiple Client Hello messages, aka GNUTLS-SA-2008-1-2.

   CVE 2008-1950
     Integer signedness error in the _gnutls_ciphertext2compressed
     function in lib/gnutls_cipher.c in libgnutls in GnuTLS before 2.2.4
     allows remote attackers to cause a denial of service (buffer over-read
     and crash) via a certain integer value in the Random field in an
     encrypted Client Hello message within a TLS record with an invalid
     Record Length, which leads to an invalid cipher padding length,
     aka GNUTLS-SA-2008-1-3.

References:
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1948
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1949
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1950

Solution:
    All GnuTLS users should upgrade to the latest version:

Risk factor : High
";

 script_description(desc);
 summary = "Determines GnuTLS < 2.2.4 vulnerability";
 script_summary(summary);
 script_category(ACT_GATHER_INFO);
 script_copyright("This script is under GPLv2");
 family = "General";
 script_family(family);
 script_dependencies("gb_gnutls_detect_win.nasl");
 script_require_keys("GnuTLS/Win/Ver");
 script_require_ports(139, 445);
 exit(0);
}


include ("version_func.inc");

gnutlsVer = get_kb_item("GnuTLS/Win/Ver");
if(gnutlsVer != NULL)
{
  if(version_is_less(version:gnutlsVer, test_version:"2.2.4")){
    security_hole(0);
  }
}
